A multinational's trade-finance team flags an unusual payment pattern late on a Friday afternoon. The counterparty's beneficial owner appears, on closer inspection, to share identifying details with a name on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons). By Monday morning, the question is no longer whether there is a problem. The question is how to contain it, document it, and decide what to tell OFAC – and when.
Internal sanctions investigations under OFAC are governed primarily by the Office of Foreign Assets Control's enforcement guidelines under IEEPA and related authorities. Where a potential apparent violation (a transaction or conduct that, on its face, may have breached a sanctions prohibition) is identified, the investigation process – scope, privilege, disclosure, and the decision whether to file a voluntary self-disclosure (VSD, a proactive report to OFAC that can reduce a civil penalty base) – must be handled with precision. As of April 2026, OFAC's enforcement posture has continued to reward early, well-documented voluntary disclosure; the penalty differential between a VSD and a non-disclosure matter is material.
This page explains how Calder & Vance structures internal OFAC investigations, what the governing authority requires, how the process compares with parallel obligations under OFSI and the EU, and when to involve external counsel.
What triggers an internal sanctions investigation under OFAC?
An internal sanctions investigation is triggered when a business identifies facts that may constitute an apparent violation of a US sanctions programme administered by OFAC. Triggers are varied: a screening hit that survives initial review, a whistleblower report, a payment that a correspondent bank has rejected or queried, a counterparty disclosure, an M&A diligence finding, or a proactive audit. The common thread is that ordinary business processes have surfaced facts that are inconsistent with clean compliance.
In our experience, the initial trigger is rarely the full picture. A single rejected payment often turns out, on investigation, to be one of a series. An SDN hit on a supplier may reveal a broader web of indirect exposure across an ownership chain. This is why the first decision – how wide to scope the investigation – is also the most consequential. Scope too narrowly and you produce a defence that OFAC will later deconstruct. Scope too broadly and you generate documents that exceed what you can review, assess, and manage under privilege.
The legal authority that governs the consequences is IEEPA and the relevant programme regulations, which OFAC administers. These instruments set the maximum civil penalty base, the framework for assessing aggravating and mitigating factors, and the criteria OFAC uses to evaluate the quality of a VSD. Conduct that meets OFAC's definition of egregious – typically: senior management involvement, a pattern of violations, deliberate concealment – is assessed differently from an isolated, good-faith compliance failure. Understanding which category your facts fall into is step one of the internal process.
How should a business structure the investigation itself?
An effective internal OFAC investigation has five sequential phases: trigger assessment and privilege preservation; scope setting; evidence collection and document review; factual findings; and the disclosure decision. Each phase has legal implications that downstream to the next.
The trigger assessment decides whether the apparent violation is isolated or systemic and whether it is likely to be treated as egregious. This is also the point at which legal privilege must be established – the investigation should be directed by counsel from the outset, with a clear instruction letter that anchors the work product under attorney-client privilege. Companies that begin internal investigations without counsel direction, then bring in lawyers to review the output, often find that early internal communications are discoverable.
Scope setting must balance thoroughness against proportionality. In our cross-border practice, we define the scope by reference to three variables: the transaction universe (what period, what entities, what business lines), the category of violation (a particular sanctions programme, a specific prohibition), and the remediation perimeter (what needs to change in the programme, not just what happened historically). A written scope document – approved before substantive review begins – is the first document OFAC will ask about in any subsequent review.
Evidence collection covers trade documents, payment records, customer onboarding files, screening logs and override records, and – critically – any internal communications about the flagged counterparty or transaction. Screening override records are frequently the most damaging: an override granted at a low level, without documented rationale, that was not escalated is exactly the fact pattern OFAC treats as an aggravating indicator.
The factual findings memo, prepared under privilege, should answer six questions: what happened; when did it happen; who was involved; what did they know and when; what was the dollar value of the conduct; and what aggravating or mitigating features are present. That structure maps directly to OFAC's civil penalty framework, making the memo a usable input to a VSD or a penalty defence.
The disclosure decision turns on the findings. If the conduct is apparent and material, a VSD is generally the right outcome. If the facts are genuinely ambiguous – the SDN match is weak, the transaction may fall within a general licence, the nexus to the US is contestable – a more cautious posture may be appropriate. That assessment requires legal judgment, not a policy default.
The position above covers the standard case. Your facts – the counterparty, the goods, the currency, the correspondent bank, and the specific programme in play – change the analysis significantly. For a preliminary assessment of your situation, contact Calder & Vance at info@caldervance.com.
What is the VSD process and what does it change?
A voluntary self-disclosure is a proactive, complete, and accurate report to OFAC of an apparent violation, filed before OFAC has opened an investigation of its own. The mechanism matters because OFAC's enforcement guidelines treat a qualifying VSD as a significant mitigating factor – one that can reduce the base penalty amount by a substantial proportion. The reduction applies to both the penalty base calculation and OFAC's overall settlement posture.
To qualify as a VSD and receive full credit, the disclosure must be: voluntary (not prompted by an OFAC inquiry or a third-party report that OFAC has already received); timely (submitted within a reasonable period after the violation is discovered, without unreasonable delay); and complete (covering all material facts, including facts that are unfavourable). A partial or delayed disclosure receives reduced or no credit.
The VSD submission itself is a structured document. It identifies the submitting entity, describes the relevant programme and the prohibition at issue, sets out the factual findings in full, provides supporting documentation, and includes a description of the remedial actions taken or committed. OFAC expects the submission to demonstrate that the company understands what happened, why it happened, and what it has done to prevent recurrence.
After submission, OFAC may accept the VSD and close the matter with a cautionary letter, impose a reduced civil penalty, or – in egregious cases – proceed to a more formal enforcement process notwithstanding the VSD. OFAC also has the option of referring the matter to DOJ for criminal review. In our practice, the quality of the investigation underlying the VSD – the rigour of the evidence review, the candour of the findings, and the credibility of the remedial action – is the single largest variable in the outcome.
How do parallel UK and EU obligations interact with an OFAC investigation?
An apparent OFAC violation rarely exists in isolation. For a business with European operations or a European banking relationship, the same underlying transaction may also implicate OFSI's financial-sanctions regime in the UK or the relevant EU Council regulation. Each regime has its own reporting obligations, its own penalty authority, and its own conception of what voluntary cooperation looks like.
Under the UK regime, OFSI has a statutory reporting obligation: a person who knows or has reasonable cause to suspect that a counterparty is a designated person, or that a sanction has been breached, must report to OFSI. This is not discretionary. The UK reporting window is shorter than the period OFAC allows for a VSD, and the failure to report promptly is itself an aggravating factor in any OFSI enforcement action. Henry Ashworth, our UK sanctions partner, notes that in matters involving concurrent OFAC and OFSI exposure, the timing of the UK report frequently drives the overall disclosure sequence.
Under the EU, Council regulations impose asset-freezing obligations on entities that are established in, or operate through, an EU member state. The obligation to report a suspected breach runs to the relevant national competent authority – which differs by member state. In some EU jurisdictions the reporting deadline is measured in days; in others it is less prescriptive. Claire Dubois, our EU sanctions partner, advises that the EU disclosure should be coordinated with the OFAC VSD to ensure consistency in the factual narrative – inconsistencies between disclosures made to different regulators are a separate risk.
The cross-border coordination issue is not only about timing. OFAC's extraterritorial reach under IEEPA means that even a European transaction can fall within US jurisdiction if there is a US dollar payment, a US person involved in the transaction, or US-origin goods. Where the same conduct falls under multiple regimes, a single integrated investigation – rather than three separate enquiries – produces a more coherent factual record and reduces the risk of conflicting characterisations across disclosures.
If a transaction has already been flagged by a correspondent bank or a filing has been rejected, an early cross-regime review can preserve options that narrow quickly. Contact Calder & Vance at info@caldervance.com for a confidential assessment.
What are the most common risk flags in an internal OFAC investigation?
The risk flags that most frequently convert a manageable compliance failure into an egregious enforcement matter are: screening override records without documented rationale; knowledge of the designation at the time of the transaction; involvement of senior management; a pattern of similar transactions rather than an isolated incident; concealment or destruction of documents; and a failure to escalate an internal alert.
Screening overrides deserve particular attention. A compliance team that overrides a screening hit – even in good faith, because the match probability is low – must document the rationale at the point of the override. Undocumented overrides discovered during an internal investigation are difficult to explain to OFAC. Did someone actually conclude the match was a false positive, or did someone simply clear the queue?
Document preservation is a second frequent failure point. Once a potential violation is identified, a litigation hold must issue immediately to all custodians who may hold relevant records. Companies that delete documents in the ordinary course of a document-retention schedule after the trigger point has been identified face a separate evidentiary problem that can transform a civil matter into a criminal referral.
A further risk concerns the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked, even if the entity is not itself listed). Investigations frequently reveal that a counterparty was never screened against the ownership chain – only against the entity name. A company whose parent crosses the 50 percent threshold is blocked regardless of whether it appears on the SDN List by name. Screening tools that do not reach through the ownership structure create exactly this gap.
Finally, a myth worth correcting: many compliance teams assume that because no funds were ultimately transferred to a blocked person – because the payment was rejected – there is no apparent violation. That is incorrect. An attempted transaction that is stopped at the correspondent bank can still constitute an apparent violation of the relevant prohibition. The attempt, not the consummation, is the trigger.
How does Calder & Vance conduct an internal OFAC investigation?
We scope the apparent violation, advise on voluntary self-disclosure, and prepare the penalty defence – acting as investigation counsel from the trigger through to the resolution. Our work on an internal OFAC investigation typically covers the following:
- Trigger and privilege assessment: We review the initial facts, establish the legal-privilege structure, and issue a document-preservation notice to relevant custodians within the first business day.
- Scope definition: We prepare a written scope document that defines the transaction universe, the legal issue, and the remediation perimeter. This document forms the spine of the investigation record.
- Evidence review: We direct the review of trade documents, payment records, screening logs, override records, and communications. Where the volume is large, we design a structured review protocol. We work with the client's internal legal team or, where needed, with specialist document-review support.
- Ownership and control mapping: We map the beneficial ownership of all flagged counterparties against the SDN List and applicable blocked-property rules, including through the 50 percent rule, to establish whether the relevant entities were blocked at the time of the transaction.
- Factual findings memo: We prepare the privileged findings document, structured to map against OFAC's civil penalty criteria – the factors OFAC uses to assess severity, mitigation, and the appropriateness of a VSD.
- Disclosure decision: We advise on whether to file a VSD, the timing of that filing, and the parallel obligations under OFSI, the relevant EU competent authority, or other regimes that may also have jurisdiction.
- VSD drafting and submission: Where a VSD is appropriate, we draft and submit the disclosure to OFAC, coordinate parallel disclosures to OFSI or EU authorities, and manage the regulator's follow-up queries.
- Remediation: We advise on the programme changes required – screening logic, override controls, training, and escalation procedures – and document them in the remedial action report that accompanies or follows the VSD.
In a recent matter, a financial-services business identified a potential exposure through a correspondent-bank query. We scoped the apparent violation, advised on voluntary self-disclosure, and prepared the penalty defence. The disclosure was made with a complete factual record and a documented remediation plan. The matter was resolved without a finding of egregious conduct.
A common assumption is that an internal investigation can be run effectively by the compliance team alone, without external counsel, because the facts are straightforward. In our experience, the facts are rarely as straightforward as they appear at the trigger stage, and an investigation conducted without legal privilege from the outset creates a record that is difficult to manage in any subsequent OFAC review. The decision to involve specialist counsel is not an admission of severity; it is a protection of the investigation's value.
Related practices
- EU apparent violation assessment – scoping and advising on apparent violations under EU Council regulations and parallel disclosure obligations
- OFAC enforcement defence and penalty mitigation – representation in OFAC civil penalty proceedings and pre-penalty notice response
- Sanctions compliance programme review – testing screening logic, ownership mapping, and remediation design against the five-element OFAC compliance standard
Frequently asked questions on internal sanctions investigations under OFAC
How long does an internal investigation take under OFAC?
The duration depends on the volume of transactions at issue, the complexity of the ownership chain, and the number of business lines involved. A well-scoped investigation involving a limited transaction set can produce findings within four to eight weeks. Investigations involving a multi-year transaction history, multiple entities, or a cross-border element typically take longer. The VSD, once filed, initiates an OFAC review process that may take several months to conclude. Delay in starting the investigation adds to both the overall timeline and the risk that OFAC opens its own inquiry in the interim. Verify the current OFAC processing period before relying on any specific estimate.
What are the main risks in internal sanctions investigations under OFAC?
The main risks are: conducting the investigation without legal privilege, which makes the findings discoverable; scoping too narrowly and producing a record that OFAC later extends; failing to preserve documents at the trigger point; producing a VSD that is incomplete or inconsistent with parallel disclosures to OFSI or EU authorities; and misclassifying the conduct as non-egregious when the facts point the other way. Each of these risks compounds the civil – and in serious cases, criminal – exposure. Early involvement of investigation counsel is the most effective control against all five.
Do we need specialist counsel for internal sanctions investigations?
Specialist sanctions counsel is not legally required, but it is consistently the approach that produces better outcomes in OFAC matters. An internal compliance team can identify the facts; counsel structures the privilege, assesses the legal character of the conduct, prepares the VSD, and coordinates with OFSI or EU authorities where parallel obligations apply. Businesses that attempt to manage an OFAC investigation without experienced external counsel often present a factual record to OFAC that is incomplete, inconsistently characterised, or – in the worst cases – contradicted by documents the company did not review before filing. The cost of specialist counsel is substantially lower than the cost of a poorly executed disclosure.
About the author
J. M. Aldridge advises multinationals and financial institutions on US sanctions and export controls, with a focus on OFAC licensing, secondary-sanctions risk, and BIS classification. Calder & Vance – International Sanctions & Export Control Counsel.
About Calder & Vance
Calder & Vance is an independent international sanctions and export-control boutique. We advise multinationals, financial institutions, exporters, and individuals on the major regimes – OFAC and BIS in the United States, OFSI and ECJU in the United Kingdom, the EU Council regulations and the EU General Court, the United Nations Consolidated List, and the regimes of Switzerland, Canada, Australia, the UAE, Singapore, and Japan. Our work is limited to lawful compliance, licensing, delisting, enforcement defence, and due diligence. To discuss a matter, contact info@caldervance.com.
Disclaimer: This material is general information, not legal advice, and is not a substitute for advice on your specific facts. Sanctions and export-control rules change frequently and differ by regime; verify the current position before relying on anything stated here. Calder & Vance does not advise on circumventing or evading sanctions. For advice on your situation, contact info@caldervance.com.